# may 2025

> markdown for agents. every page and download is listed in [llms.txt](https://cvegen.art/llms.txt).

![drybrush poster for may 2025, painted from 3,980 published cves](https://media.cvegen.art/posters/2025-05/1280.jpg?v=f77134de93)

what the poster shows: 31 days as bands of dry brush, the first day at the top. 7 ran above the 2025 average for their weekday and sweep fast and wide; the other 24 are slow, level strokes. two inks: the deep one for open-source packages, enterprise vendors, the linux kernel, browsers and ai software, the pale one for everything else.

the poster being painted, a 12 second film: [mp4](https://media.cvegen.art/films/2025-05.mp4?v=c8381f751b)

| fact | value |
| --- | --- |
| cves | 3,980 |
| against an average 2025 month | 1.0× |
| busiest day | may 1, 372 |
| rated critical, cvss 9 or higher | 347 |
| critical with no login and no click | 303 |
| used in real attacks | 19 |

## may 2025 in numbers

may 2025 brought 3,980 cves, close to an average 2025 month. 7 of its 31 days ran above the 2025 average for that weekday.

- 372 on may 1, the busiest day. the linux kernel team published 245 of them at once.
- 347 rated critical, cvss 9 or higher. 303 of them can be hit over the network with no login and nothing for a user to click.
- 603 came in three single drops: the linux kernel team 245 on may 1, wpscan 203 on may 15, patchstack 155 on may 7.

## 19 already used in real attacks

cisa kev, as of oct 24, 2026.

### by product

- 5 microsoft windows, may 13
- 3 telemessage tm sgnl, may 8, 28
- 2 sysaid, may 7
- 2 ivanti endpoint manager mobile, may 13
- 1 srimax output messenger, may 5
- 1 craft cms, may 7
- 1 fortinet products, may 13
- 1 samsung magicinfo 9 server, may 13
- 1 sap netweaver, may 13
- 1 smartbedded meteobridge, may 21
- 1 versa concerto, may 21

### every cve

- may 5, srimax output messenger, [cve-2025-27920](https://www.cve.org/CVERecord?id=CVE-2025-27920)
- may 7, sysaid sysaid on-prem, [cve-2025-2775](https://www.cve.org/CVERecord?id=CVE-2025-2775)
- may 7, sysaid sysaid on-prem, [cve-2025-2776](https://www.cve.org/CVERecord?id=CVE-2025-2776)
- may 7, craft cms craft cms, [cve-2025-35939](https://www.cve.org/CVERecord?id=CVE-2025-35939)
- may 8, telemessage tm sgnl, [cve-2025-47729](https://www.cve.org/CVERecord?id=CVE-2025-47729)
- may 13, microsoft windows, [cve-2025-30397](https://www.cve.org/CVERecord?id=CVE-2025-30397)
- may 13, microsoft windows, [cve-2025-30400](https://www.cve.org/CVERecord?id=CVE-2025-30400)
- may 13, microsoft windows, [cve-2025-32701](https://www.cve.org/CVERecord?id=CVE-2025-32701)
- may 13, microsoft windows, [cve-2025-32706](https://www.cve.org/CVERecord?id=CVE-2025-32706)
- may 13, microsoft windows, [cve-2025-32709](https://www.cve.org/CVERecord?id=CVE-2025-32709)
- may 13, fortinet multiple products, [cve-2025-32756](https://www.cve.org/CVERecord?id=CVE-2025-32756)
- may 13, sap netweaver, [cve-2025-42999](https://www.cve.org/CVERecord?id=CVE-2025-42999)
- may 13, ivanti endpoint manager mobile (epmm), [cve-2025-4427](https://www.cve.org/CVERecord?id=CVE-2025-4427)
- may 13, ivanti endpoint manager mobile (epmm), [cve-2025-4428](https://www.cve.org/CVERecord?id=CVE-2025-4428)
- may 13, samsung magicinfo 9 server, [cve-2025-4632](https://www.cve.org/CVERecord?id=CVE-2025-4632)
- may 21, versa concerto, [cve-2025-34026](https://www.cve.org/CVERecord?id=CVE-2025-34026)
- may 21, smartbedded meteobridge, [cve-2025-4008](https://www.cve.org/CVERecord?id=CVE-2025-4008)
- may 28, telemessage tm sgnl, [cve-2025-48927](https://www.cve.org/CVERecord?id=CVE-2025-48927)
- may 28, telemessage tm sgnl, [cve-2025-48928](https://www.cve.org/CVERecord?id=CVE-2025-48928)

cisa keeps adding older cves when attacks come to light, so this list can still grow.

## this poster

| fact | value |
| --- | --- |
| period | may 1 to 31, 2025 |
| cves | 3,980 |
| data | cve list v5, cisa kev, drawn 2026-10-24 |
| format | 3:4, drawn for 45 × 60 cm |

[download jpg, 2000 × 2667](https://media.cvegen.art/posters/2025-05/2000.jpg?v=f77134de93)

## other months

- before: [april 2025](https://cvegen.art/2025/04.md), 4,033 cves
- after: [june 2025](https://cvegen.art/2025/06.md), 3,682 cves
- [all months](https://cvegen.art/index.md)